Penetration Testing

Attackers don’t wait. Our penetration testing finds your weak spots first, across apps, systems, and networks so you can fix them fast.

Talk to an expert

Uncover security risks

Which vulnerabilities could put your business at risk?

Every business faces unique security challenges - our penetration testing is tailored to your systems, teams and objectives to uncover real risks.

Find vulnerabilities in obscure systems

Our specialist testing service covers things like biometrics, hardware and radio spectrum security reviews

Specialist Testing

Gain awareness of security issues with AI

Provide assurance to the business that the new AI system or integration you are deploying has been designed with security in mind.

Artificial Intelligence (AI) Penetration Test

Review the security of your critical business apps

Bugs don’t always live in the interface. We go behind the scenes to inspect your code for logic flaws, backdoors, and insecure development practices.

Application Penetration Tests

Identify vulnerabilities in source code

Review your application source code for misconfigurations, poor secret management, security vulnerabilities and potential back doors

Source Code Review

Review device configurations for security issues

Review the security controls present in your newly deployed network infrastructure or server/desktop configuration.

Configuration Reviews

Simulate DoS attacks before real ones hit

How does your system handle pressure? We simulate DoS attacks to stress-test your apps, networks, and incident response capabilities.

Denial of Service (DoS) Testing

Test your people, not just your systems

Can your team spot a fake login page? We run phishing simulations to test human defences and build stronger awareness across your workforce.

Social Engineering & Phishing

Turn testing into training

During a live attack simulation, Purple Teaming helps your defence team detect and respond in real time.

Carefully identify risks with OT and SCADA network

Identify risks in your mission critical systems without disrupting normal business operations with our OT/SCADA network penetration test

OT/SCADA Network Penetration Test

Find vulnerabilities before attackers do

You won't see it coming. Scan your systems for known risks and prioritise what needs fixing.

Vulnerability Assessment

Identify vulnerabilities in your systems

Understand the vulnerabilities present in your internet-facing systems, and whether an attacker can compromise them to access your systems and data.

External Penetration Testing

We show you how easily devices can be accessed.

What if an attacker got inside your network? We simulate real-world breaches to uncover risks and help you strengthen your internal defences.

Internal Penetration Testing

Identify vulnerabilities in your web application

Understand the vulnerabilities present in your web applications, and whether an attacker can compromise them to access your customer data

Web Application Penetration Testing

Simulate a real attack

Simulate a cyberattack to test your systems, people, and processes with Red Teaming.

Find vulnerabilities in obscure systems

Our specialist testing service covers things like biometrics, hardware and radio spectrum security reviews

Specialist Testing

Gain awareness of security issues with AI

Provide assurance to the business that the new AI system or integration you are deploying has been designed with security in mind.

Artificial Intelligence (AI) Penetration Test

Review the security of your critical business apps

Bugs don’t always live in the interface. We go behind the scenes to inspect your code for logic flaws, backdoors, and insecure development practices.

Application Penetration Tests

Identify vulnerabilities in source code

Review your application source code for misconfigurations, poor secret management, security vulnerabilities and potential back doors

Source Code Review

Review device configurations for security issues

Review the security controls present in your newly deployed network infrastructure or server/desktop configuration.

Configuration Reviews

Simulate DoS attacks before real ones hit

How does your system handle pressure? We simulate DoS attacks to stress-test your apps, networks, and incident response capabilities.

Denial of Service (DoS) Testing

Test your people, not just your systems

Can your team spot a fake login page? We run phishing simulations to test human defences and build stronger awareness across your workforce.

Social Engineering & Phishing

Turn testing into training

During a live attack simulation, Purple Teaming helps your defence team detect and respond in real time.

Carefully identify risks with OT and SCADA network

Identify risks in your mission critical systems without disrupting normal business operations with our OT/SCADA network penetration test

OT/SCADA Network Penetration Test

Find vulnerabilities before attackers do

You won't see it coming. Scan your systems for known risks and prioritise what needs fixing.

Vulnerability Assessment

Identify vulnerabilities in your systems

Understand the vulnerabilities present in your internet-facing systems, and whether an attacker can compromise them to access your systems and data.

External Penetration Testing

We show you how easily devices can be accessed.

What if an attacker got inside your network? We simulate real-world breaches to uncover risks and help you strengthen your internal defences.

Internal Penetration Testing

Identify vulnerabilities in your web application

Understand the vulnerabilities present in your web applications, and whether an attacker can compromise them to access your customer data

Web Application Penetration Testing

Simulate a real attack

Simulate a cyberattack to test your systems, people, and processes with Red Teaming.

Discover our services

Comprehensive penetration testing for every layer

Cybersecurity isn't one size fits all. Our penetration testing covers infrastructure, applications, cloud environments and human behaviour to ensure nothing slips through the cracks

Application Penetration Tests

Bugs don’t always live in the interface. We go behind the scenes to inspect your code for logic flaws, backdoors, and insecure development practices.

Application Penetration Tests

Review the security of your critical business apps

Artificial Intelligence (AI) Penetration Test

AI introduces new risks. We assess the security of models, data inputs and LLMs, identifying weaknesses unique to modern AI systems.

Artificial Intelligence (AI) Penetration Test

Probe AI systems for emerging threats

Configuration Reviews

Misconfigurations are one of the most common security gaps. We review your setups, firewalls, servers, networks to ensure they are all secure.

Configuration Reviews

Find weaknesses in your systems

Denial of Service (DoS) Testing

How does your system handle pressure? We simulate DoS attacks to stress-test your apps, networks, and incident response capabilities.

Denial of Service (DoS) Testing

Simulate DoS attacks before real ones hit

External Penetration Testing

Your internet-facing assets are the front door to your business. We assess them from the outside in, like a real attacker would.

External Penetration Testing

Identify risks from the outside in

Internal Penetration Testing

What if someone got inside your network. Would your systems hold up? We simulate that exact scenario to find internal vulnerabilities before anyone else can.

Internal Penetration Testing

Test internal defences before attackers do

OT/SCADA Network Penetration Test

When it comes to industrial systems, caution is key. Our team carefully uncovers risks in OT and SCADA environments, without interrupting operations.

OT/SCADA Network Penetration Test

Secure your industrial and control systems

Your defence team learns best in real time. We collaborate with your SOC during a live attack scenario to sharpen their detection and response skills.

Bridge defence and offence for better security

Red teaming simulates real attacks to test your systems, people, and physical security. Our red team penetration testing reveals how well your defences hold up.

Red teaming for real-world resilience

Social Engineering & Phishing

Can your team spot a fake login page? We run phishing simulations to test human defences and build stronger awareness across your workforce.

Social Engineering & Phishing

Test your people, not just your systems

Source Code Review

Bugs don’t always live in the interface. We go behind the scenes to inspect your code for logic flaws, backdoors, and insecure development practices.

Source Code Review

Detect flaws at the code level

Specialist Testing

Need something weird and wonderful tested? Whether its biometric spoofing, hardware manipulation or wireless exploits, we replicate real-world criminal tactics.

Specialist Testing

Tailored testing for unique environments

Vulnerability Assessment

Think of this like a system health check. We scan for known vulnerabilities, prioritise the high-risk ones, and help you take control of the next steps.

Vulnerability Assessment

Scan for hidden risks

Web Application Penetration Testing

Your web apps are often your most exposed asset. We dive deep into their security, checking for flaws in logins, permissions, and data handling.

Web Application Penetration Testing

Uncover vulnerabilities in your web applications

Business Manager

Charity

"As a small charity that was the beneficiary of the Hacking for Heroes programme it has been fantastic working with the team at Bastion. The engagement definitely exceeded my expectations and I cannot recommend the Bastion team highly enough."

Service detail

Details

From risk assessment to rapid response - we’re with you every step of the way.

[No details]

Our delivery process

Benefits

Why partner with Bastion for penetration testing

Our penetration testing doesn’t just identify vulnerabilities, it helps you fix them. We uncover real risks and provide practical recommendations that lead to stronger, more resilient security.

Tailored to your environment

Every test is customised to your systems, goals and tech stack. You get relevant insights you can use, not just technical noise.

Clear actions, not just findings

You’ll receive a prioritised list of issues with practical steps your team can take to reduce risk and improve defences.

Support beyond the report

We don’t disappear after the test. Our team stays engaged to help you strengthen security and prepare for what’s next.

What comes next

Expand your security coverage

After testing, we help you take the next step with targeted services that reduce risk and improve your long-term security posture.

Comprehensive scoping to find the right testing approach
Clear reporting with actionable insights
Expert guidance to support remediation and next steps

Red teaming simulates real attacks to test your systems, people, and physical security. Our red team penetration testing reveals how well your defences hold up.

Secure Development Training

We train developers and engineers to identify, avoid, and mitigate common security issues — making secure coding part of everyday practice.

Testimonials

Our customers

Look what our customers have to say

Business Manager

Charity

"As a small charity that was the beneficiary of the Hacking for Heroes programme it has been fantastic working with the team at Bastion. The engagement definitely exceeded my expectations and I cannot recommend the Bastion team highly enough."

Cyber security news

Latest advisories

Stay ahead of emerging threats with our expert blog posts, research, and industry updates.

TimePictra (Microchip) – Stored Cross-Site Scripting (XSS) (CVE-2026-3010)

During a security engagement, Steve Nyan Lin discovered a stored XSS vulnerability in the TimePictra web application which was due to a lack of input filtering. This affects the neName parameter when creating new network elements.

TimePictra (Microchip) – Lack of Authentication (CVE-2026-2844)

During a security engagement, Steve Nyan Lin discovered a lack of authentication within numerous functionaliy within the TimePictra web application which allowed viewing of sensitive information and making changes to network elements.

Silverstripe - Cross-Site Scripting (XSS) Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in the administrator panel of Silverstripe CMS, specifically in the handling of the user input within the form messages module.

Frequently asked questions

Frequently asked questions

From risk assessment to rapid response - we’re with you every step of the way.

What size or type of organisation do you work with?

Our assurance and advisory services are ideal for mid-sized to large enterprises, government entities, and high-risk sectors needing strategic cybersecurity leadership, governance, and executive-level reporting.

Can we engage Bastion for a one-time consultation?

Yes. While many clients value our ongoing support, we also offer one-time strategy sessions, reviews, or incident readiness assessments.

What industries do you specialise in?

We have deep experience across critical infrastructure, finance, health, government, energy, and regulated industries, but our principles apply across all sectors facing modern cyber risks.

Why does my organization need a penetration test?

Because knowing your weaknesses is the first step to defending them. Pen testing helps uncover hidden risks, meet compliance requirements, and strengthen your overall cybersecurity posture.

Will testing disrupt our operations?

Not at all. We plan carefully to ensure minimal impact on your systems. Tests can be scheduled during low-usage periods or conducted in a staged environment if needed.

How do I book a penetration test or get a quote?

Complete the form on this page and our team will be in touch within one business day to discuss your requirements and provide a scoped proposal.

How long does a penetration test take?

A penetration test typically takes around 5 days, although the exact duration depends heavily on the agreed scope and the specific objectives of the engagement. Penetration testing is tailored to your environment, risk profile and goals, so timelines can vary accordingly.

What's the difference between a vulnerability scan and a penetration test?

A vulnerability scan uses automated tools to identify known weaknesses. A penetration test goes further - our testers simulate real attacker behaviour to validate those risks and uncover more complex issues that tools alone miss.

Do you test cloud environments, web applications and APIs?

Yes. We cover external and internal networks, web and mobile applications, cloud environments, APIs, SaaS platforms and specialist areas including OT/SCADA, wireless and hardware.

How often should we run a penetration test?

Most organisations benefit from annual testing as a baseline, with additional tests following significant changes to systems, applications or infrastructure - or when required for compliance.

Do you offer independent or CREST-certified testing?

Yes. Bastion is a CREST-certified penetration testing provider, meaning our testing meets globally recognised standards for quality, ethics and technical rigour.

Contact us

Talk to an expert

Please call our office number during normal business hours or submit a form below

Where to find us

If you experience a security breach outside normal working hours, please complete the form and we will respond as soon as possible.

Get in touch

info@bastionsecurity.co.nz

General enquiries

Auckland office

Level 5
51 Shortland Street,
Auckland 1010 New Zealand

Wellington office

Levels 8 and 9
10 Brandon Street
Wellington 6011 New Zealand

Melbourne office

Level 22
120 Spencer Street
Melbourne 3000 Australia

Are you experiencing a security breach?

Incident Response